SonicWall Patches SSL‑VPN SAML Bypass After Possible Exploitation
The U.S. Cybersecurity and Infrastructure Security Agency placed the flaw on its Known Exploited Vulnerabilities list, setting a federal remediation deadline of November 20, 2026.
Overview
- SonicWall published an advisory on November 6 and released patched SonicOS builds 7.3.4-7013 and 8.2.3-8015 for affected Gen7 and Gen8 devices.
- The flaw, tracked as CVE-2026-19868, is an authentication-enforcement bug that lets a user with valid alternate-method credentials bypass SAML checks and potentially SAML-enforced multi‑factor authentication on SSL‑VPNs configured to use SAML.
- CISA added CVE-2026-19868 to its Known Exploited Vulnerabilities catalog and ordered federal civilian agencies to remediate affected systems by November 20, 2026.
- Neither SonicWall nor CISA have released technical details or confirmed whether the issue was exploited as a zero-day before patches were available.
- The advisory follows multiple attacks targeting SonicWall appliances this year, and security teams are urged to update devices immediately, revoke suspicious credentials, and cross-check VPN session logs with SAML identity provider records for signs of bypass.